On Android, it's impossible to install the app without granting all the permissions. So if there's a feature to upload your own cover art, then you have to grant it permission to look at all your photos forever or you don't get to use the app. It's terrible.

So basically they made a design decision that was thought to be good for the users privacy and it turned out to be a horrible decision. I can understand the reasoning behind their ìnitial design, but I can't understand why this hasn't just been thrown out and replaced already after it turned out so obviously flawed?

At least they could have deprecated that system and allowed it to work with old apps, while encouraging new apps to use an iOS-like we'll-ask-when-we-need-it kind of system?

I'm pretty sure it will be available for all apps. It's going to be in the next version of Android. (edited)

You're exactly right. The context is missing. When I install an app and it asks for permission A, B, C, and D, I probably have no idea why, and it's scary.

If I'm using the app and discover a new feature that asks me for permission A, I understand why, and can make a reasonable decision.

The problem is that the granting of permission isn't strictly tried to that particular feature. So if the app asks you for permission A for "reasonable feature 1" it can then use that permission in the background for "unreasonable creepy feature 2" since you've now granted it unilateral permission.

Sure, like I said there is no way for me to know that after they asked for permission to use GPS when I engaged the "Run" function the first time, they won't spy on my location every time I just use the app (apart from the little GPS activity icon perhaps).

But the context of me switching to the "running" feature and then I'm asked if I want to allow the GPS function is enough for me to not feel watched. It's all about context.

Same if the app asked for permission to see your photos (forever) when you use the custom cover art feature.

For a malicious app this makes no difference, but for those apps we (sort of) trust, the context makes all the difference.

I don't have a solution for location, but for photos, it seems like it would be best to require no permission to present a standard control (i.e. UIImagePickerController), but with the API only actually providing any information when the control completes (photo is selected, or control is cancelled). The user selecting the photo is implicit permission.

Permission would be necessary to actually query for media programmatically, which is the real issue. Currently, they are conflated.

For location, I suppose that the "Google Maps is using your location" bar at the top could be expanded and always present when the location permission is enabled. Tapping it would revoke the permission until it is enabled again. This could get annoying though, some apps legitimately do depend on location all the time.